The multinode storage system is one of the systems for management of data on a network. The multinode storage system is constituted by a plurality of disk nodes, an access node, and a control node, which are connected through a network. A virtual disk is defined in the multinode storage system. The virtual disk is constituted by a plurality of unit storage areas called segments. The disk nodes manage storage areas in storage devices connected to the disk nodes by dividing the storage devices into unit areas called slices. The control node manages the correspondences between the segments (constituting the virtual disk) and the slices (managed by the respective disk nodes), and sends to the access node metadata indicating the correspondences between the segments and the slices. When the access node receives a request for data access designating data in the virtual disk, the access node determines a slice corresponding to the segment and storing the data, on the basis of the metadata. Then, the access node sends an access request to a disk node managing the slice.
In the above multinode storage system, the user of the access node can use a number of storage devices connected to the plurality of disk nodes as if to use a local storage device. Further, it is possible to redundantly (doubly) store data and realize redundant data storage by allocating two slices to each segment. In the case where the data are redundantly stored, it is possible to prevent loss of the data even when a storage device fails.
However, even in the case where the data are redundantly stored, the data redundancy in some segments is broken when failure of a storage device impedes access to the storage device. In such a case, recovery processing is performed. In the recovery processing, the control node allocates a new slice to each segment in which the data redundancy is broken (i.e., each segment in which the data redundancy is to be recovered). Then, the control node stores in the newly allocated slice a duplicate of the data in the segment. Thus, the data redundancy in each segment is recovered.
The attributes “primary slice” and “secondary slice” are respectively assigned to the two slices allocated to each segment in the virtual disk, and the access node accesses the primary slice. When a storage device containing a primary slice fails, the control node changes the attribute of the secondary slice to the primary slice, so that the access node can access data identical to the data stored in the failed storage device before completion of the recovery processing. (See, for example, International Patent Publication WO2004/104845.)
Incidentally, the functional failure of the storage device is one of failures which impede data access from the access node. When a failure occurs in a storage device, a disk node detects the failure, and informs the control node of the occurrence of the failure, so that the control node can recognize the occurrence of the failure. Then, the recovery processing is performed under control of the control node. Nevertheless, in order to prevent erroneous failure detection, it is necessary to determine the occurrence of a failure after a certain suspension time elapses since the detection of the failure by the disk node. During the suspension time, processing for changing a storage device to be accessed by the access node to another storage device is not performed, and therefore data access from the access node is suspended.
When a failure occurs in a storage device containing a primary slice, access from the access node to the primary slice occurring after the occurrence of the failure becomes an error. On the other hand, the disk node cannot know whether an irrecoverable failure occurs, or a transient trouble occurs so that the access becomes possible after some suspension time elapses. Therefore, until a predetermined suspension time elapses, the disk node does not determine that the storage device fails. Thus, the timing of the change of the attribute from the secondary slice to the primary slice is delayed, so that the duration for which the access from the access node is suspended increases.